How to make an HTTPS call in a Doker Busybox container with Go running?

Question

I am trying to make an HTTPS call in a Docker container running Go binary. This gives me the following error:

x509: Failed to load system roots and missing roots

Having looked at this, it seems the problem is that the BusyBox docker image does not have a root CA certificate. From other answers to StackOverflow, it seems like the best approach is to set the CA root in the container directory /etc/ssl/certs.

To test locally, it makes sense to mount the root CA certificate of the host computer. When starting up in production (I use the Google Container Engine), I'm not sure how to specify the root CA certificate. Do I need to create it myself? Or is there an existing certificate in GKE that I can reuse?

Answer 1

There are several options you can have.

Share host certificates

As you indicated, you can share /etc/ssl/certswith the host.

Use busybox with certificates

You can use an image of a type odise/busybox-curlthat already has certificates installed.

,

version: '2'

services:
  busybox:
    image: busybox
    command: sleep 1000
    volumes:
      - certificates:/etc/ssl/certs:ro
  certifcate_installer:
    image: alpine
    command: sh -c 'apk update && apk add ca-certificates'
    volumes:
      - certificates:/etc/ssl/certs
volumes:
  certificates:

Dockerfile

FROM alpine as certs
RUN apk update && apk add ca-certificates

FROM busybox
COPY --from=certs /etc/ssl/certs /etc/ssl/certs

vagrant@vagrant:~/certs$ docker build -t busyboxcerts .
Sending build context to Docker daemon  49.66kB
Step 1/4 : FROM alpine as certs
 ---> 4a415e366388
Step 2/4 : RUN apk update && apk add ca-certificates
 ---> Running in 0059f93b5fc5
fetch http://dl-cdn.alpinelinux.org/alpine/v3.5/main/x86_64/APKINDEX.tar.gz
fetch http://dl-cdn.alpinelinux.org/alpine/v3.5/community/x86_64/APKINDEX.tar.gz
v3.5.2-131-g833fa41a4d [http://dl-cdn.alpinelinux.org/alpine/v3.5/main]
v3.5.2-125-g9cb91a548a [http://dl-cdn.alpinelinux.org/alpine/v3.5/community]
OK: 7966 distinct packages available
(1/1) Installing ca-certificates (20161130-r1)
Executing busybox-1.25.1-r0.trigger
Executing ca-certificates-20161130-r1.trigger
OK: 5 MiB in 12 packages
 ---> 1a84422237e4
Removing intermediate container 0059f93b5fc5
Step 3/4 : FROM busybox
 ---> efe10ee6727f
Step 4/4 : COPY --from=certs /etc/ssl/certs /etc/ssl/certs
 ---> af9936f55fc4
Removing intermediate container 1af54c34a5b5
Successfully built af9936f55fc4
Successfully tagged busyboxcerts:latest
vagrant@vagrant:~/certs$ docker run busyboxcerts:latest ls /etc/ssl/certs
02265526.0
024dc131.0
03179a64.0

​​ . https://docs.docker.com/engine/userguide/eng-image/multistage-build/#before-multi-stage-builds

.

Answer 2

CA , apk add ca-certificates && update-ca-certificates, .